Tüm alıştırma soruları

1964 soru

Tüm türler1,964 Çoktan seçmeli1,006 Çoklu seçim931 Sıralama27

An enterprise is designing a centralized logging solution to aggregate VPC Flow Logs from 80 member accounts in an AWS Organization. A solutions architect is tasking with configuring the delivery of these flow logs to a single Amazon S3 bucket located in a dedicated Security account. The S3 bucket must be encrypted at rest. Which TWO of the following configurations are required to ensure the flow logs can be successfully delivered to the centralized S3 bucket?

Geçerli olan tümünü seçin

Configure the Amazon S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions for the delivery.logs.amazonaws.com service principal.

Encrypt the Amazon S3 bucket using a Customer Managed Key (CMK) in AWS KMS, and update the KMS key policy to allow the delivery.logs.amazonaws.com service principal to use the key.

Encrypt the S3 bucket using the default AWS managed KMS key (aws/s3) and configure the key policy to grant cross-account permissions to the member accounts.

Configure a Service Control Policy (SCP) at the organization root that explicitly allows the s3:PutObject permission on the Security account S3 bucket for all member accounts.

Configure the destination S3 bucket policy to grant s3:PutObject permissions to the individual IAM roles used by the instances in the member accounts.

Cevabı ve açıklamayı göster

Cevap: Configure the Amazon S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions for the delivery.logs.amazonaws.com service principal.; Encrypt the Amazon S3 bucket using a Customer Managed Key (CMK) in AWS KMS, and update the KMS key policy to allow the delivery.logs.amazonaws.com service principal to use the key.

Cevap

Configure the destination S3 bucket policy to allow permissions for the delivery.logs.amazonaws.com service principal, and encrypt the bucket using a Customer Managed Key in AWS KMS with a key policy that allows the delivery.logs.amazonaws.com service principal to use the key.

For cross-account VPC Flow Logs delivery, the S3 bucket policy must allow the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl actions. Furthermore, if the bucket is encrypted, a Customer Managed Key must be used because AWS managed KMS keys cannot be configured with custom policies to allow service principal access.

Adım Adım Çözüm

Configure S3 bucket policy permissions for log delivery

The S3 bucket in the Security account now accepts writes from the VPC Flow Logs delivery service.

Since VPC Flow Logs are delivered via a service principal rather than IAM roles, the bucket policy must explicitly permit the delivery.logs.amazonaws.com principal.

Create and configure a Customer Managed Key (CMK) in AWS KMS

A CMK is created with a key policy allowing the delivery.logs.amazonaws.com service principal to perform kms:GenerateDataKey*.

AWS-managed KMS keys do not support key policy modifications and cannot be shared. A Customer Managed Key is required to permit the cross-account log delivery service to write encrypted data to the bucket.

Anahtar Kavram

Centralized VPC Flow Logs delivery to a cross-account S3 bucket requires configuring the bucket policy and KMS key policy to permit the log delivery service principal.

Tahmini Süre:1m 30s

Soru 2Soru →

A company needs to interconnect 20 VPCs across multiple AWS accounts in a single AWS Region. The network design must support routing between all VPCs and an on-premises data center. Additionally, instances in all VPCs must be able to resolve domain names hosted in a single Route 53 Private Hosted Zone (PHZ) in a central shared services account. The solution must minimize administrative overhead and maintain high availability for outbound internet traffic. Which solution meets these requirements?

Associate a Direct Connect Gateway directly with the Virtual Private Gateways (VGWs) of all 20 VPCs, and rely on the Direct Connect Gateway to route transitive traffic between the VPCs and to the on-premises data center.

Deploy an AWS Transit Gateway to interconnect the VPCs and connect the on-premises network. Associate the centralized Route 53 Private Hosted Zone with all VPCs across the accounts, and deploy redundant NAT Gateways across multiple Availability Zones in an egress VPC.

Deploy an AWS Transit Gateway to interconnect the VPCs and connect the on-premises network. Configure a Route 53 Private Hosted Zone in the central account but do not associate it with the other VPCs, assuming DNS queries will route over the Transit Gateway.

Deploy an AWS Transit Gateway to interconnect the VPCs. Route all outbound internet traffic from all Availability Zones in the attached VPCs through a single NAT Gateway located in a single public subnet of a centralized egress VPC.

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway to interconnect the VPCs and connect the on-premises network. Associate the centralized Route 53 Private Hosted Zone with all VPCs across the accounts, and deploy redundant NAT Gateways across multiple Availability Zones in an egress VPC.

Cevap

The correct architecture uses AWS Transit Gateway to act as a centralized hub for routing traffic transitively between all 20 VPCs and the on-premises data center. To allow DNS resolution for shared internal domains, the Route 53 Private Hosted Zone (PHZ) must be associated with all consumer VPCs across the accounts. Finally, high availability for egress traffic is maintained by using redundant NAT Gateways across multiple Availability Zones in the centralized egress VPC.

Adım Adım Çözüm

Evaluate the routing requirements for transitive VPC-to-VPC and hybrid traffic.

Determine that AWS Transit Gateway is the appropriate service to support transitive routing and simplify connectivity for 20 VPCs.

Direct Connect Gateway cannot perform transitive routing between VPCs directly, making Transit Gateway necessary.

Evaluate the DNS configuration needed for cross-account private DNS resolution.

Determine that the central Private Hosted Zone (PHZ) must be associated with every VPC that requires resolution.

VPCs cannot resolve records in a PHZ unless the PHZ is explicitly associated with them.

Assess the high availability configuration for outbound internet traffic.

Determine that redundant NAT Gateways must be deployed across multiple Availability Zones in the central egress VPC.

A single NAT Gateway creates a single point of failure for outbound traffic across all Availability Zones.

Anahtar Kavram

AWS Transit Gateway for transitive hybrid routing, centralized Route 53 Private Hosted Zone association, and multi-AZ redundant egress architecture.

Soru 3Soru →

An enterprise is designing a multi-account AWS environment using AWS Organizations. The security team must enforce the following compliance requirements:

1. Member accounts must not be able to disable or disassociate Amazon GuardDuty.
2. A custom IAM role named `SecurityAuditRole` in member accounts, which is used for security scanning, must be protected against modification or deletion by any user in those accounts.
3. Centralized AWS CloudTrail logs from all member accounts must be encrypted in a dedicated S3 bucket in a Security account using an encryption key that permits cross-account log delivery.

Which combination of actions will meet these requirements with the least operational complexity?

Apply a Service Control Policy (SCP) at the Organization root that denies guardduty:Delete* and guardduty:Disassociate*, and denies IAM write actions where the resource is arn:aws:iam::*:role/SecurityAuditRole. Ensure local users in member accounts are granted permissions via local IAM policies. For CloudTrail, encrypt the S3 bucket in the Security account using an AWS KMS customer managed key, and update its key policy to allow the CloudTrail service principal from the Organization to perform cryptographic operations.

Apply a Service Control Policy (SCP) at the Organization root that grants full administrator privileges to all users, except for denying guardduty:Delete* and guardduty:Disassociate*, and denying IAM write actions on arn:aws:iam::*:role/SecurityAuditRole. Rely on this SCP to grant access to member account users without configuring local IAM policies. For CloudTrail, encrypt the S3 bucket in the Security account using an AWS KMS customer managed key, and update its key policy to allow the CloudTrail service principal.

Apply a Service Control Policy (SCP) at the Organization root that denies guardduty:Delete* and guardduty:Disassociate*, and denies IAM write actions where the resource is arn:aws:iam::*:role/SecurityAuditRole. In the member accounts, grant permissions via local IAM policies. For CloudTrail, encrypt the S3 bucket in the Security account using the default AWS managed key (aws/s3), and configure the key policy of aws/s3 to allow the CloudTrail service principal from all member accounts to perform cryptographic operations.

Apply a Service Control Policy (SCP) at the Organization root that denies guardduty:Delete* and guardduty:Disassociate*, and denies IAM write actions on arn:aws:iam::*:role/SecurityAuditRole. Create the SecurityAuditRole in all member accounts and establish a trust relationship with an external SAML identity provider, specifying the sts:AssumeRole action in the trust policy instead of sts:AssumeRoleWithSAML to simplify federated access. For CloudTrail, encrypt the S3 bucket in the Security account using an AWS KMS customer managed key.

Cevabı ve açıklamayı göster

Cevap: Apply a Service Control Policy (SCP) at the Organization root that denies guardduty:Delete* and guardduty:Disassociate*, and denies IAM write actions where the resource is arn:aws:iam::*:role/SecurityAuditRole. Ensure local users in member accounts are granted permissions via local IAM policies. For CloudTrail, encrypt the S3 bucket in the Security account using an AWS KMS customer managed key, and update its key policy to allow the CloudTrail service principal from the Organization to perform cryptographic operations.

Cevap

Apply a Service Control Policy (SCP) at the Organization root that denies guardduty:Delete* and guardduty:Disassociate*, and denies IAM write actions where the resource is the specific SecurityAuditRole. Ensure local users in member accounts are granted permissions via local IAM policies. For CloudTrail, encrypt the S3 bucket in the Security account using an AWS KMS customer managed key, and update its key policy to allow the CloudTrail service principal from the Organization to perform cryptographic operations.

The correct solution uses an Organization-level SCP to restrict administrative actions (GuardDuty deletion and modification of the SecurityAuditRole) while relying on local IAM policies to grant permissions. It also uses a customer managed KMS key to support cross-account log encryption for CloudTrail, which is a requirement since AWS-managed keys cannot be shared across accounts.

Adım Adım Çözüm

Enforce preventative guardrails using AWS Organizations Service Control Policies (SCPs).

SCPs are applied at the root of the Organization, preventing all roles/users (including root users of member accounts) from deleting/disassociating GuardDuty or modifying the SecurityAuditRole.

SCPs establish permission boundaries across the multi-account structure but do not grant permissions directly.

Configure local IAM permissions inside member accounts.

Local administrators configure IAM users, groups, or roles with policy access.

Since SCPs only filter permissions, local IAM policies are still required to grant active permissions.

Set up centralized logging and custom key encryption.

Create a customer managed key (CMK) in KMS in the Security account, configure its policy to allow CloudTrail from the Organization to encrypt logs, and specify this key for the S3 bucket encryption.

AWS-managed KMS keys (like aws/s3) cannot be shared across accounts or customized, necessitating the use of a Customer Managed Key.

Anahtar Kavram

AWS Organizations SCP boundaries combined with Customer Managed KMS Keys for cross-account governance.

Soru 4Soru →

A commercial satellite imaging enterprise is designing a real-time satellite telemetry and command ingestion platform. The application tier consists of containerized microservices running on AWS Fargate behind an Application Load Balancer (ALB). The data tier uses an Amazon Aurora PostgreSQL database. The primary environment is hosted in the us-east-1 Region, and the company requires a disaster recovery (DR) environment in the us-west-2 Region.

The architecture must satisfy the following business and technical requirements:
- A Recovery Point Objective (RPO) of less than 1 minute.
- A Recovery Time Objective (RTO) of less than 15 minutes.
- Internal microservices must resolve service endpoints privately inside the VPCs of both Regions using the domain name satellite.internal.
- Outbound API commands sent from Fargate tasks to ground stations must remain highly available even if an entire Availability Zone experiences an outage.

Which of the following architectures meets these requirements with the lowest operational overhead?

Deploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In both Regions, deploy Fargate tasks across two Availability Zones, routing outbound internet traffic from all private subnets through a single NAT Gateway located in the primary Availability Zone of each Region to optimize NAT running costs. Create a Route 53 Private Hosted Zone for satellite.internal and associate it with the VPCs in both us-east-1 and us-west-2. Set up Route 53 Failover routing with health checks.

Deploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In both Regions, deploy Fargate tasks across at least two Availability Zones, configuring route tables to point outbound internet traffic to independent NAT Gateways in each Availability Zone. Create a Route 53 Private Hosted Zone for satellite.internal and associate it with the VPCs in both us-east-1 and us-west-2. Set up Route 53 Failover routing with health checks to manage external traffic redirection during a failover.

Deploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In both Regions, deploy Fargate tasks across at least two Availability Zones, configuring route tables to point outbound internet traffic to independent NAT Gateways in each Availability Zone. Create a Route 53 Private Hosted Zone for satellite.internal in us-east-1, but do not associate it with the VPC in us-west-2, relying instead on Route 53 Resolver endpoint rules to forward queries to us-east-1. Set up Route 53 Failover routing with health checks.

Configure AWS Backup to take hourly copy-replicated snapshots of the Amazon Aurora DB cluster in us-east-1 and copy them to us-west-2, restoring the database in the secondary Region during failover. In both Regions, deploy Fargate tasks across at least two Availability Zones, configuring route tables to point outbound internet traffic to independent NAT Gateways in each Availability Zone. Create a Route 53 Private Hosted Zone for satellite.internal and associate it with the VPCs in both us-east-1 and us-west-2. Set up Route 53 Failover routing with health checks.

Cevabı ve açıklamayı göster

Cevap: Deploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In both Regions, deploy Fargate tasks across at least two Availability Zones, configuring route tables to point outbound internet traffic to independent NAT Gateways in each Availability Zone. Create a Route 53 Private Hosted Zone for satellite.internal and associate it with the VPCs in both us-east-1 and us-west-2. Set up Route 53 Failover routing with health checks to manage external traffic redirection during a failover.

Cevap

The architecture that uses Amazon Aurora Global Database for sub-second cross-region replication, independent NAT Gateways in each Availability Zone of both Regions for high availability of outbound API calls, associates the Route 53 Private Hosted Zone with both regional VPCs for private name resolution, and uses Route 53 Failover routing for external traffic management.

The correct architecture uses Amazon Aurora Global Database to achieve low latency cross-region replication, ensuring that RPO and RTO goals are met. Outbound network traffic is protected from AZ failures by deploying redundant, local NAT Gateways within each zone. Private internal name resolution for satellite.internal is correctly established by associating the Route 53 Private Hosted Zone with the VPCs in both regions, and Route 53 Failover routing handles external traffic redirection smoothly.

Adım Adım Çözüm

Evaluate the database replication strategy against RPO and RTO targets.

To meet an RPO under 1 minute and RTO under 15 minutes, cross-region replication must be continuous. Amazon Aurora Global Database provides sub-second replication latency, meeting the 1-minute RPO. Restoring from hourly backups fails both the RPO (1 hour) and RTO (restore time is typically >15 minutes).

Eliminates backup-and-restore options that fail RPO/RTO constraints.

Assess the high availability design of NAT Gateways for outbound container communication.

Configuring Fargate tasks across multiple AZs but routing all outbound traffic through a single NAT Gateway in one AZ exposes the system to complete outbound failure if that AZ goes down. Deploying independent NAT Gateways per AZ guarantees high availability.

Eliminates designs that introduce a single point of failure in outbound network pathways.

Confirm DNS configuration for internal resolution of custom hostnames across Regions.

Route 53 Private Hosted Zones must be explicitly associated with all VPCs that require local resolution of those private records. Without associating the hosted zone with the disaster recovery VPC, resources in the secondary region cannot resolve internal endpoints.

Secures functional name resolution in the secondary region during a failover event.

Anahtar Kavram

Disaster recovery design involving cross-region database replication, private DNS routing across multi-region VPCs, and Availability Zone level redundancy for egress networking.

Tahmini Süre:3m 0s

Soru 5Soru →

A gaming platform is launching a new multiplayer architecture in the `us-west-2` Region. The platform architecture requires two application VPCs (`vpc-game-prod-a` and `vpc-game-prod-b`) and one administrative management VPC (`vpc-mgmt-prod`). The management VPC hosts a Route 53 Private Hosted Zone (PHZ) `backend.gaming.internal` containing service endpoints that the application VPCs must resolve privately. The application VPCs must also access the internet for software updates through a centralized egress VPC (`vpc-egress-prod`) to minimize costs, but the egress path must survive a single Availability Zone (AZ) outage without disrupting egress traffic from unaffected AZs. Additionally, the game VPCs and management VPC must communicate with an on-premises graphics rendering cluster via a 10 Gbps AWS Direct Connect connection. Which TWO options should the Solutions Architect implement to satisfy these networking and DNS requirements?

Geçerli olan tümünü seçin

Deploy an AWS Transit Gateway (`tgw-main`) and attach `vpc-game-prod-a`, `vpc-game-prod-b`, and `vpc-egress-prod`. In `vpc-egress-prod`, deploy a NAT Gateway in Availability Zone `us-west-2a` and another in `us-west-2b`. In the subnet route tables for the Transit Gateway attachment in `vpc-egress-prod`, configure the route for `0.0.0.0/0` to point to the NAT Gateway in the respective Availability Zone. Configure the Transit Gateway route table associated with the game VPCs to route `0.0.0.0/0` to the `vpc-egress-prod` attachment.

In the management account, create a cross-account VPC association authorization for `vpc-game-prod-a` and `vpc-game-prod-b` to the Private Hosted Zone `backend.gaming.internal`. In each game account, associate the respective game VPC with the Private Hosted Zone using the AWS CLI or API.

Deploy an AWS Transit Gateway (`tgw-main`) and attach `vpc-game-prod-a`, `vpc-game-prod-b`, and `vpc-egress-prod`. In `vpc-egress-prod`, deploy a single NAT Gateway in Availability Zone `us-west-2a`. Configure the Transit Gateway route table associated with the game VPCs to route `0.0.0.0/0` to the `vpc-egress-prod` attachment, and route all egress traffic in `vpc-egress-prod` to this single NAT Gateway.

Create a Route 53 Resolver Inbound Endpoint in `vpc-mgmt-prod` and a Route 53 Resolver Outbound Endpoint in each game VPC. Create a Route 53 Resolver rule in the management account to forward queries for `backend.gaming.internal` to the Outbound Endpoints in the game VPCs, and share the rule across the AWS Organization using AWS Resource Access Manager.

Create an AWS Direct Connect Gateway (`dxgw-main`) and associate it directly with the Virtual Private Gateways of `vpc-game-prod-a`, `vpc-game-prod-b`, and `vpc-mgmt-prod`. Configure the Direct Connect Gateway to route traffic transitively between these VPCs and the on-premises graphics rendering cluster.

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway (`tgw-main`) and attach `vpc-game-prod-a`, `vpc-game-prod-b`, and `vpc-egress-prod`. In `vpc-egress-prod`, deploy a NAT Gateway in Availability Zone `us-west-2a` and another in `us-west-2b`. In the subnet route tables for the Transit Gateway attachment in `vpc-egress-prod`, configure the route for `0.0.0.0/0` to point to the NAT Gateway in the respective Availability Zone. Configure the Transit Gateway route table associated with the game VPCs to route `0.0.0.0/0` to the `vpc-egress-prod` attachment.; In the management account, create a cross-account VPC association authorization for `vpc-game-prod-a` and `vpc-game-prod-b` to the Private Hosted Zone `backend.gaming.internal`. In each game account, associate the respective game VPC with the Private Hosted Zone using the AWS CLI or API.

Cevap

Deploy an AWS Transit Gateway and establish a centralized egress VPC with redundant NAT Gateways configured with AZ-specific routing, combined with cross-account Private Hosted Zone VPC associations.

Centralizing outbound egress traffic using Transit Gateway requires deploying a NAT Gateway in each active Availability Zone of the egress VPC and ensuring the subnet route tables route traffic to the NAT Gateway in the same zone. This maintains AZ isolation and resilience. Sharing a Route 53 Private Hosted Zone across AWS accounts is most efficiently achieved by creating a cross-account VPC association authorization in the hosted zone owner's account and executing the association in the client VPCs' accounts.

Adım Adım Çözüm

Analyze egress requirements

Identified that a single NAT Gateway violates the high availability requirement across Availability Zones. Redundant NAT Gateways must be deployed in each active Availability Zone within the egress VPC, and subnets must route traffic based on their respective zone.

Ensures that a failure in one Availability Zone does not impact outbound traffic originating from or routed through other zones.

Analyze private DNS requirements

Determined that Route 53 Private Hosted Zones can be shared cross-account by generating a VPC association authorization from the owner account and accepting it from the consumer accounts.

Avoids the unnecessary deployment costs and management overhead of Route 53 Resolver Inbound and Outbound Endpoints for simple internal resolution.

Verify transitive routing constraints

Confirmed that Direct Connect Gateway alone does not support transitive routing between associated virtual private gateways. AWS Transit Gateway must be used for transit routing.

Adheres to AWS architectural constraints regarding the non-transitive nature of Direct Connect Gateway.

Anahtar Kavram

Designing highly resilient, cost-effective centralized egress topologies using AWS Transit Gateway and managing cross-account private DNS resolution without adding operational complexity.

Tahmini Süre:3m 0s

Soru 6Soru →

A company is designing a new relational Online Transaction Processing (OLTP) system. The system has key performance indicators requiring a recovery point objective (RPO) of zero (no data loss) and a recovery time objective (RTO) of less than 60 seconds during an Availability Zone outage. Additionally, the database must dynamically scale its read capacity to handle sudden spikes in query volume. Which of the following database configurations meets these requirements?

Deploy an Amazon Aurora MySQL DB cluster with a primary instance and configure Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization.

Deploy an Amazon RDS for MySQL DB instance in a Multi-AZ deployment, and configure the application to send read queries directly to the standby instance in the secondary Availability Zone during peak traffic.

Deploy a single-node Amazon RDS for MySQL DB instance, and configure a cross-region read replica to act as the primary failover target with an automated script to promote the replica within 60 seconds.

Deploy an Amazon Aurora MySQL DB cluster, configure cross-account sharing using AWS-managed KMS keys to run read replicas in a secondary audit account, and scale them to absorb the read spikes.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora MySQL DB cluster with a primary instance and configure Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization.

Cevap

Deploy an Amazon Aurora MySQL DB cluster with a primary instance and configure Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization.

The correct option addresses all requirements: Amazon Aurora replicates data synchronously to multiple Availability Zones within the region (maintaining an RPO of zero). It supports dynamic scaling of up to 15 Aurora Replicas using Aurora Auto Scaling to handle sudden increases in read volume. In the event of a primary instance failure, Aurora automatically fails over to one of the replicas in less than 30 seconds, which satisfies the RTO constraint of less than 60 seconds.

Adım Adım Çözüm

Evaluate the database replication and high availability requirements.

An RPO of zero requires synchronous replication inside a single region, which is supported by Amazon Aurora's cluster volume write-path replication and RDS Multi-AZ synchronous replication.

Asynchronous replication (such as cross-region replicas) can lead to data loss and violates the RPO of zero constraint.

Determine the capability of the database architecture to serve read traffic.

Select a service that supports active horizontal read scaling. Aurora Replicas serve read queries and support Auto Scaling, whereas RDS Multi-AZ standby instances cannot be accessed for queries.

RDS standby instances are strictly passive and cannot offload read queries.

Confirm cross-account and encryption configurations if applicable.

Ensure KMS key sharing constraints are respected. Customer Managed Keys are required for cross-account resource sharing, as AWS-managed KMS keys cannot be shared.

AWS-managed keys cannot be updated with custom policies to allow external accounts.

Anahtar Kavram

Amazon Aurora vs. Amazon RDS Multi-AZ scaling and high availability features

Soru 7Soru →

A software-as-a-service (SaaS) collaboration platform uses an Amazon RDS for PostgreSQL DB instance to manage user workspaces, active tasks, and team permissions. During peak business hours, the database experiences severe performance degradation, with CPU utilization exceeding 90% and query response times increasing significantly.

A database analysis reveals two main contributors to the bottleneck:
1. A massive volume of repetitive, read-only queries from application servers fetching static team permission configurations.
2. Exhaustion of database connection limits due to thousands of transient AWS Lambda functions frequently opening and closing connections to verify user session tokens.

The session token verification data changes dynamically and must be cached with high availability. The cache must support replication and automatic failover across multiple Availability Zones to prevent user session loss if a primary cache node fails.

Which architecture should a solutions architect implement to address these performance bottlenecks while meeting the high availability requirements?

Deploy an Amazon RDS Proxy between the Lambda functions and the PostgreSQL database to manage connection pooling, and implement an Amazon ElastiCache for Redis replication group with Multi-AZ enabled to cache the team permission rules and user session tokens.

Deploy an Amazon RDS Proxy between the Lambda functions and the PostgreSQL database to manage connection pooling, and implement an Amazon ElastiCache for Memcached cluster to cache the team permission rules and user session tokens.

Enable Multi-AZ deployment on the Amazon RDS for PostgreSQL DB instance, route the read-only queries for the team permission rules to the standby replica, and configure AWS Lambda reserved concurrency to limit the database connection count.

Deploy an Amazon ElastiCache for Memcached cluster with automatic replication across multiple Availability Zones to cache the team permission rules and user session tokens, and configure the Lambda functions to use an RDS Read Replica for database connection pooling.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon RDS Proxy between the Lambda functions and the PostgreSQL database to manage connection pooling, and implement an Amazon ElastiCache for Redis replication group with Multi-AZ enabled to cache the team permission rules and user session tokens.

Cevap

The correct solution uses Amazon RDS Proxy to pool database connections from the AWS Lambda functions, solving the connection exhaustion problem. It also uses an Amazon ElastiCache for Redis replication group with Multi-AZ enabled, meeting the replication and automatic failover requirements to ensure that cached session tokens survive node failures.

Adım Adım Çözüm

Address the connection limit exhaustion caused by transient compute resources.

Introduce Amazon RDS Proxy to pool and share database connections from the AWS Lambda functions.

Lambda functions scale rapidly and open many short-lived connections, which easily exhausts database connection limits. RDS Proxy keeps database connections open and multiplexes the incoming traffic.

Select the correct caching engine based on high availability and replication requirements.

Choose Amazon ElastiCache for Redis over ElastiCache for Memcached.

The scenario requires session data to survive cache node failures through replication and automatic failover across multiple Availability Zones. Redis supports replication groups and Multi-AZ failover, whereas Memcached is a non-replicated cache.

Evaluate the read-scaling mechanism for database queries.

Avoid routing read traffic to the RDS Multi-AZ standby.

RDS standby replicas in a Multi-AZ deployment are passive and cannot serve read traffic. Offloading read queries requires a caching layer (like Redis) or dedicated Read Replicas.

Anahtar Kavram

Database connection pooling and cache replication strategies

Tahmini Süre:2m 30s

Soru 8Soru →

An enterprise deploys its core e-commerce application on Amazon EC2 instances within an Auto Scaling group (ASG) using AWS CloudFormation. Recently, engineers manually modified several security groups associated with the ASG, leading to configuration drift and subsequent deployment failures during CloudFormation stack updates. Additionally, during a rapid scale-out event, the ASG launched multiple instances that were immediately added to the Application Load Balancer (ALB) target group before their local bootstrapping scripts finished installing required packages, resulting in transient HTTP 502 errors for clients. A Solutions Architect must design an automated solution to remediate the configuration drift and ensure newly launched instances do not receive traffic until bootstrapping completes successfully. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure an Auto Scaling group lifecycle hook for the EC2_INSTANCE_LAUNCHING transition. Modify the EC2 user data script to perform the bootstrapping tasks, and upon successful completion, execute the complete-lifecycle-action CLI command to transition the instance to the InService state.

Deploy the AWS Config managed rule cloudformation-stack-drift-detection-check to monitor the stack. Configure an Amazon EventBridge rule to detect non-compliant status events and trigger an AWS Systems Manager Automation runbook to remediate the drifted resources.

Increase the Auto Scaling group cooldown period and configure the Application Load Balancer health check grace period to exceed the maximum package installation time of the bootstrapping script.

Attach a Service Control Policy (SCP) at the Organization root that denies the cloudformation:UpdateStack API action to all users, forcing all updates to go through the central CI/CD pipeline.

Configure a Systems Manager State Manager association to remediate drift by retrieving the golden configuration templates from a centralized Amazon S3 bucket, decrypting the templates using the default AWS-managed KMS key (aws/s3) shared across accounts.

Cevabı ve açıklamayı göster

Cevap: Configure an Auto Scaling group lifecycle hook for the EC2_INSTANCE_LAUNCHING transition. Modify the EC2 user data script to perform the bootstrapping tasks, and upon successful completion, execute the complete-lifecycle-action CLI command to transition the instance to the InService state.; Deploy the AWS Config managed rule cloudformation-stack-drift-detection-check to monitor the stack. Configure an Amazon EventBridge rule to detect non-compliant status events and trigger an AWS Systems Manager Automation runbook to remediate the drifted resources.

Cevap

To resolve these issues, configure an Auto Scaling lifecycle hook to pause the EC2_INSTANCE_LAUNCHING state while user data completes bootstrapping and signals completion, and utilize AWS Config stack drift detection integrated with Amazon EventBridge and AWS Systems Manager Automation to detect and remediate infrastructure resource drift.

The correct architecture uses an Auto Scaling lifecycle hook to hold the instance in a launching state, allowing the user data script to perform bootstrapping tasks and signal completion before the instance is marked healthy and registered with the ALB. Additionally, deploying AWS Config with drift detection rules and automating remediation through EventBridge and Systems Manager Automation ensures that any manual alterations to resources are detected and corrected automatically without human intervention.

Adım Adım Çözüm

Address the premature registration of instances by adding an EC2_INSTANCE_LAUNCHING lifecycle hook to the Auto Scaling group.

The instances will remain in the 'Pending:Wait' state rather than immediately moving to 'InService'.

This prevents the ALB target group from routing client traffic to the instance before it is fully configured.

Update the EC2 user data script to perform the configuration steps and then call the complete-lifecycle-action CLI command.

Upon successful completion of the bootstrap script, the instance transitions to 'InService' and begins serving traffic.

This guarantees that only fully bootstrapped and verified instances receive traffic.

Deploy the cloudformation-stack-drift-detection-check rule in AWS Config and configure a rule in Amazon EventBridge.

Configuration drift is monitored automatically, and EventBridge captures any non-compliant drift notifications.

AWS Config tracks whether resources managed by a stack have been manually altered.

Link the EventBridge rule to an AWS Systems Manager Automation runbook.

An automated workflow is triggered to revert manual alterations or run appropriate drift remediation steps.

This automates the continuous alignment of resources to their defined infrastructure-as-code baseline.

Anahtar Kavram

Continuous alignment of infrastructure states using automated drift remediation combined with safe scaling lifecycle boundaries.

Tahmini Süre:3m 0s

Soru 9Soru →

A solutions architect is planning the heterogeneous migration of a production on-premises MySQL database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The migration must minimize downtime, and the database experiences high write activity. The solutions architect has already run the AWS Schema Conversion Tool (SCT) to convert the database schema. To complete the migration, AWS Database Migration Service (DMS) will be used with Change Data Capture (CDC) enabled.

Which two actions must the solutions architect perform to prepare the source database and ensure successful CDC replication? (Select two.)

Geçerli olan tümünü seçin

Configure the MySQL configuration file on the source database to set binlog_format to ROW and binlog_row_image to FULL.

Configure the source database to retain binary logs for a minimum of 24 hours to prevent data loss before AWS DMS processes them.

Configure the MySQL source database to set binlog_format to STATEMENT to optimize write performance and reduce log storage size.

Configure the AWS Schema Conversion Tool (SCT) data agent to capture database changes in real time and apply them to the target cluster.

Configure the target Aurora PostgreSQL DB cluster to run in MySQL compatibility mode to avoid converting the database schema.

Cevabı ve açıklamayı göster

Cevap: Configure the MySQL configuration file on the source database to set binlog_format to ROW and binlog_row_image to FULL.; Configure the source database to retain binary logs for a minimum of 24 hours to prevent data loss before AWS DMS processes them.

Cevap

To perform successful Change Data Capture (CDC) from an on-premises MySQL database to Amazon Aurora PostgreSQL, you must set the source parameters binlog_format to ROW and binlog_row_image to FULL. Additionally, the source database must be configured to retain its binary logs for at least 24 hours to prevent replication errors.

To successfully perform Change Data Capture (CDC) from an on-premises MySQL database using AWS DMS, row-based logging must be enabled by setting the binary log format to ROW and the binary log row image to FULL. Additionally, the source database must be configured to retain these binary logs for a sufficient duration (typically at least 24 hours) to prevent the log files from being purged before AWS DMS can read and apply the changes.

Adım Adım Çözüm

Configure source binary logging parameters

Setting binlog_format to ROW and binlog_row_image to FULL ensures the necessary row-level change detail is logged.

AWS DMS requires detailed row-level change information in the binary logs to perform CDC replication from MySQL.

Configure binary log retention policy on the source

Configuring the retention to at least 24 hours prevents logs from being purged before they are consumed by the DMS replication task.

High-write environments generate large amounts of logs; if the retention period is too short, DMS will miss changes, causing the task to fail.

Verify schema conversion and launch DMS task

The target schema is already converted via SCT, and the DMS task starts replicating data from the source to the target.

DMS requires the schema to be present on the target before replicating data, and then relies on the configured binlogs to perform ongoing replication.

Anahtar Kavram

Configuring MySQL source databases for Change Data Capture (CDC) replication using AWS DMS requires setting specific binary logging configurations (ROW format and FULL row image) and ensuring binary logs are retained long enough to prevent replication failures.

Tahmini Süre:2m 0s

Soru 10Soru →

An energy utility company is migrating its regional billing system to AWS. The current architecture consists of 150 VMware vSphere VMs running Red Hat Enterprise Linux (RHEL) and Windows Server that host the web and application tiers, and 12 physical bare-metal servers running IBM AIX that host the core database engines. The security team has dictated two compliance requirements: (1) no software agents may be installed on the bare-metal database servers, and (2) the network team needs exact network dependency mappings (active ports, IP addresses, and connections) for the RHEL and Windows VMs to design target AWS Security Groups. The solutions architect must discover this environment, map the dependencies, and track the migration status from a centralized console. Which approach meets these requirements with the least operational effort?

Deploy the AWS Application Discovery Agent on the VMware vSphere VMs to collect network dependency mappings. For the IBM AIX database servers, manually collect their specifications and network connections, and import the data into AWS Migration Hub using the import CSV template. Use AWS Migration Hub to track the migration.

Deploy the AWS Application Discovery Agentless Collector on the VMware vSphere vCenter Server to gather VM configuration and network dependencies. For the IBM AIX database servers, install the AWS Application Discovery Agent directly to capture database connections. Use AWS Migration Hub to track the migration.

Deploy the AWS Application Discovery Agentless Collector on the VMware vSphere vCenter Server. For the IBM AIX database servers, manually collect their configurations and upload them using the AWS Migration Hub import CSV template. Use AWS Migration Hub to track the migration.

Deploy the AWS Application Discovery Agent on all VMware vSphere VMs and the IBM AIX database servers. Enable agent-based discovery to stream all configuration, network connection, and process details directly to the Application Discovery Service. Use AWS Migration Hub to track the migration.

Cevabı ve açıklamayı göster

Cevap: Deploy the AWS Application Discovery Agent on the VMware vSphere VMs to collect network dependency mappings. For the IBM AIX database servers, manually collect their specifications and network connections, and import the data into AWS Migration Hub using the import CSV template. Use AWS Migration Hub to track the migration.

Cevap

The correct option is correct because the AWS Application Discovery Agent supports Windows and Linux operating systems on VMware VMs and gathers the detailed network connection mapping required for designing target AWS Security Groups. Since IBM AIX is not supported by the Discovery Agent and security policies prevent agent installation on the database tier, manually collecting the database configuration details and importing them using the AWS Migration Hub CSV template is the only viable approach that fulfills all security and OS constraints.

Adım Adım Çözüm

Analyze VM discovery requirements

The RHEL and Windows VMs require network dependency mapping (IPs, ports, connections) to build security groups.

This requirement determines whether to use the Agent-based or Agentless discovery tool.

Evaluate AWS Application Discovery Service tools

Identify that the Agentless Collector only gathers configuration and performance metrics, while the Application Discovery Agent captures network connections.

Choosing the agent for VMs ensures that network dependency mapping data is successfully collected.

Evaluate AIX and bare-metal constraints

The IBM AIX servers run on bare-metal and cannot support the discovery agent, and installing agents on these database servers is blocked by compliance.

Alternative discovery methods must be chosen for the database tier.

Select data import method for database tier

Choose the Migration Hub CSV import template to record the configurations of the AIX databases.

Manual import is the standard method for recording servers that cannot run agents or agentless collection.

Consolidate monitoring

Integrate both the agent-based discovery data and the manually imported CSV data into AWS Migration Hub.

This provides a single dashboard to track the migration status of all assets.

Anahtar Kavram

AWS Application Discovery Service supports agent-based discovery (which captures process and network dependency details) and agentless discovery (which captures configuration and performance metrics for VMware VMs). When servers cannot run agents due to OS support (such as IBM AIX) or security policies, the AWS Migration Hub import CSV template allows solutions architects to manually add these assets to the migration inventory.

Tahmini Süre:2m 0s

Soru 11Soru →

An enterprise needs to migrate $350\text{ TB}$ of data from an on-premises SMB file share to an Amazon FSx for Windows File Server file system. The company has a dedicated $150\text{ Mbps}$ internet connection. The migration must be completed within $21$ days. In addition, all transferred data must be encrypted at rest using an AWS KMS customer managed key (CMK). Any incremental updates made on-premises during the migration must be captured and synced to AWS. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Order AWS Snowball Edge Storage Optimized devices. Set the destination to an Amazon S3 bucket, and specify an AWS KMS customer managed key to encrypt the data on the devices.

Deploy AWS DataSync agents on-premises, and configure tasks to copy the imported bulk data from the Amazon S3 bucket to Amazon FSx, and subsequently sync the incremental changes from the on-premises SMB share to Amazon FSx.

Deploy AWS DataSync agents on-premises, and configure a task to replicate the entire

350\text{ TB}

dataset directly from the SMB file share to Amazon FSx for Windows File Server over the network.

Order AWS Snowball Edge Storage Optimized devices. Set the destination to an Amazon S3 bucket, and specify the default AWS managed key (`aws/s3`) to encrypt the data on the devices.

Configure an AWS Direct Connect gateway to route transitive traffic directly between the staging VPC containing the Amazon S3 bucket and the destination VPC containing the Amazon FSx file system.

Cevabı ve açıklamayı göster

Cevap: Order AWS Snowball Edge Storage Optimized devices. Set the destination to an Amazon S3 bucket, and specify an AWS KMS customer managed key to encrypt the data on the devices.; Deploy AWS DataSync agents on-premises, and configure tasks to copy the imported bulk data from the Amazon S3 bucket to Amazon FSx, and subsequently sync the incremental changes from the on-premises SMB share to Amazon FSx.

Cevap

Order AWS Snowball Edge Storage Optimized devices using a customer managed key for encryption, and deploy AWS DataSync agents to manage the data replication to Amazon FSx and incremental synchronization from the on-premises SMB share.

The correct strategy combines offline data migration using AWS Snowball Edge to overcome network bandwidth limitations with online replication using AWS DataSync. Ordering AWS Snowball Edge Storage Optimized devices with a customer managed key satisfies the encryption requirement and timeline for the bulk of the data. Deploying AWS DataSync allows the organization to move the imported bulk data from S3 to Amazon FSx for Windows File Server and sync any subsequent changes from the on-premises SMB share over the network.

Adım Adım Çözüm

Calculate the transfer time for the initial load over the network.

The theoretical transfer time for

350\text{ TB}

over

150\text{ Mbps}

is approximately

216

days (

350 \times 10^{12} \times 8 / 150 \times 10^6 \approx 18,666,667

seconds), which violates the

21

-day migration window.

Determines whether an online transfer is feasible or if an offline transfer mechanism (Snowball Edge) is required.

Determine the Snowball encryption requirements.

Specify an AWS KMS customer managed key (CMK) for the Snowball job.

AWS managed keys (such as `aws/s3`) cannot be used for Snowball Edge encryption because their policies cannot be modified to authorize the Snowball service.

Plan the ingestion from the Snowball destination to the target file system and the incremental sync.

Use AWS DataSync to copy the imported bulk data from the Amazon S3 bucket to Amazon FSx, and then sync any incremental changes from the on-premises SMB share directly to Amazon FSx.

AWS DataSync supports copying data between AWS storage services and syncing changes from on-premises sources over the network, which completes the migration and captures any modifications made during transit.

Anahtar Kavram

Selecting the optimal data transfer strategy based on dataset size, available network bandwidth, time constraints, and KMS security policies.

Soru 12Soru →

A manufacturing company is modernizing its warehouse inventory tracking system by refactoring a legacy monolithic application into a serverless architecture on AWS. The system must process barcode scanning events from multiple warehouses globally. These scans are ingested via Amazon API Gateway and processed by an AWS Lambda function that updates a central Amazon Aurora PostgreSQL database situated in a private VPC subnet. The volume of scans fluctuates significantly throughout the day, peaking at thousands of events per second during shift changes. During initial load testing, the application encounters database connection exhaustion errors, and other critical business functions in the same AWS account experience throttling. Which of the following actions should the Solutions Architect recommend to address these issues and ensure a reliable, scalable architecture? (Select TWO.)

Geçerli olan tümünü seçin

Establish an Amazon RDS Proxy endpoint within the VPC to pool and reuse database connections from the Lambda function to the Aurora PostgreSQL database.

Configure reserved concurrency for the Lambda function to limit its maximum concurrent executions, preventing it from exhausting the regional account concurrency pool.

Deploy the Lambda function in a private VPC subnet and route all outbound traffic through a single NAT Gateway in one Availability Zone to reach the public API Gateway endpoints.

Encrypt the database credentials in AWS Systems Manager Parameter Store using the default AWS-managed KMS key (aws/kms) and grant cross-account access to the Lambda execution role in a separate operations account.

Configure a rolling update deployment strategy directly in the CloudFormation template for the Lambda function to allow automatic zero-downtime rollbacks based on CloudWatch alarms.

Cevabı ve açıklamayı göster

Cevap: Establish an Amazon RDS Proxy endpoint within the VPC to pool and reuse database connections from the Lambda function to the Aurora PostgreSQL database.; Configure reserved concurrency for the Lambda function to limit its maximum concurrent executions, preventing it from exhausting the regional account concurrency pool.

Cevap

Establish an Amazon RDS Proxy endpoint within the VPC to pool database connections, and configure reserved concurrency for the Lambda function to limit its concurrent executions.

Establishing an Amazon RDS Proxy pools database connections, preventing the Lambda function from exhausting the PostgreSQL connection limit. Configuring reserved concurrency prevents the Lambda function from scaling unbounded and exhausting the regional concurrency limit, which would otherwise throttle other critical functions in the AWS account.

Adım Adım Çözüm

Address database connection exhaustion by introducing a database proxy.

Amazon RDS Proxy pools connections, shielding the Aurora PostgreSQL database from connection spikes caused by highly concurrent Lambda executions.

Lambda scales horizontally by creating new execution environments, each of which establishes a new database connection. RDS Proxy intercepts these and manages a pool of persistent connections.

Protect the regional concurrency pool from depletion during traffic surges.

Reserved concurrency limits the maximum instances of the Lambda function that can run concurrently, preventing it from consuming the entire account's concurrency limits.

Without concurrency limits, a spike in inventory scans could exhaust the default account limit of 1,000 concurrent executions, causing all other functions in the region to fail with throttling errors.

Anahtar Kavram

Serverless connection pooling and concurrency management are critical when modernizing legacy workloads to Lambda and API Gateway to protect downstream resources and account limits.

Soru 13Soru →

A retail corporation is designing a new Point of Sale (POS) transaction processing pipeline across multiple accounts under AWS Organizations. The application tier runs on Amazon EC2 instances in a dedicated Ingestion VPC inside the Production Account (111122223333). These instances must upload transaction logs directly to an Amazon S3 bucket located in a centralized Compliance Account (444455556666). The compliance team requires that all uploaded logs be encrypted at rest using a Key Management Service (KMS) key managed exclusively by the compliance team. The ingestion application must be able to encrypt the logs during upload but must be strictly prevented from decrypting the logs once they are written. Furthermore, key administration must be restricted to the Compliance Account, and administrators in the Production Account must not have permissions to modify the key's configuration. Which combination of actions should the Solutions Architect take to design a compliant control structure? (Select TWO.)

Geçerli olan tümünü seçin

In the Compliance Account (444455556666), create a Customer Managed KMS key. Configure the key policy to grant the Production Account (111122223333) IAM role permission to perform the kms:GenerateDataKey and kms:DescribeKey actions, while omitting the kms:Decrypt permission for this role.

In the Compliance Account (444455556666), configure the S3 bucket policy to grant the Production Account (111122223333) IAM role permission for the s3:PutObject action, and enforce a condition requiring the s3:x-amz-server-side-encryption header to be set to aws:kms referencing the Customer Managed KMS key's Amazon Resource Name (ARN).

In the Compliance Account (444455556666), configure default S3 bucket encryption using the AWS-managed KMS key for Amazon S3 (aws/s3), and modify its key policy to delegate cross-account encryption and decryption rights to the Production Account (111122223333) IAM role.

Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the Production Account that explicitly grants the EC2 instance profile role cross-account kms:GenerateDataKey permissions for the key in the Compliance Account, overriding local policy constraints.

In the Compliance Account (444455556666), configure the S3 bucket policy to allow anonymous uploads restricted by the aws:PrincipalOrgID condition, and delegate KMS key permission enforcement to an S3 Access Point registered in the Production Account.

Cevabı ve açıklamayı göster

Cevap: In the Compliance Account (444455556666), create a Customer Managed KMS key. Configure the key policy to grant the Production Account (111122223333) IAM role permission to perform the kms:GenerateDataKey and kms:DescribeKey actions, while omitting the kms:Decrypt permission for this role.; In the Compliance Account (444455556666), configure the S3 bucket policy to grant the Production Account (111122223333) IAM role permission for the s3:PutObject action, and enforce a condition requiring the s3:x-amz-server-side-encryption header to be set to aws:kms referencing the Customer Managed KMS key's Amazon Resource Name (ARN).

Cevap

To achieve secure cross-account logging with proper segregation of duties, the solutions architect must create a Customer Managed Key (CMK) in the Compliance Account and grant the Production Account's IAM role permissions to generate and describe data keys (but not decrypt). Additionally, the Compliance Account S3 bucket policy must grant s3:PutObject to the Production IAM role while enforcing the use of the specific Customer Managed Key ARN using policy condition keys.

The correct combination requires creating a Customer Managed Key (CMK) in the Compliance Account, since only CMKs support the key policy modifications required for cross-account delegation. The key policy must grant key generation and description permissions to the Production Account IAM role while omitting decryption permissions to enforce segregation of duties. Simultaneously, the S3 bucket policy in the Compliance Account must grant PutObject permissions to the Production IAM role and enforce compliance by requiring that all uploads use the specified key via request headers.

Adım Adım Çözüm

Determine the correct KMS key type for cross-account sharing.

Identify that a Customer Managed Key (CMK) must be created in the Compliance Account (444455556666) because AWS-managed keys (aws/s3) cannot be shared across accounts.

AWS-managed keys do not permit policy modification, meaning they cannot delegate cross-account access.

Enforce segregation of duties in the KMS key policy.

Configure the key policy of the CMK to grant kms:GenerateDataKey and kms:DescribeKey to the Production Account (111122223333) IAM role, but omit kms:Decrypt.

This allows the ingestion application to write and encrypt logs but prevents it from reading or decrypting logs once uploaded.

Configure S3 bucket boundary controls.

Write an S3 bucket policy in the Compliance Account allowing s3:PutObject for the Production role with a condition requiring s3:x-amz-server-side-encryption-aws-kms-key-id to match the CMK ARN.

Enforces that all uploaded objects must use the designated compliance key, blocking unencrypted or incorrectly encrypted uploads.

Anahtar Kavram

Cross-account KMS key sharing and S3 bucket access control design

Tahmini Süre:3m 0s

Soru 14Soru →

A logistics company is designing a new international package tracking application. The application requires a relational database to store shipping transit logs (OLTP workload). The system must meet a recovery point objective (RPO) of under 5 seconds and a recovery time objective (RTO) of under 2 minutes in the event of a regional outage. Additionally, the database must support low-latency local read access and horizontal read scaling for users in both the primary and secondary AWS regions. Which database and storage strategy meets these requirements?

Deploy Amazon RDS for PostgreSQL with Multi-AZ enabled in the primary region and a cross-region read replica in the secondary region. Route local read traffic in the primary region to the Multi-AZ standby database instance to scale read performance during peak tracking hours.

Deploy an Amazon Aurora Global Database. Use a customer managed KMS key in the primary region and a corresponding customer managed KMS key in the secondary region for encryption. Configure Aurora Auto Scaling for readers in both the primary and secondary regions to handle read traffic spikes.

Deploy an Amazon Aurora Global Database. Encrypt the primary cluster using the default AWS-managed KMS key (aws/rds), and modify the default key policy to grant the secondary region's replication infrastructure access to decrypt the data.

Deploy a single-region Amazon Aurora PostgreSQL database. Configure AWS Backup to take continuous backups and copy them to the secondary region. In the event of a regional outage, restore the database from the copied backup in the secondary region.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora Global Database. Use a customer managed KMS key in the primary region and a corresponding customer managed KMS key in the secondary region for encryption. Configure Aurora Auto Scaling for readers in both the primary and secondary regions to handle read traffic spikes.

Cevap

Deploy an Amazon Aurora Global Database with customer managed KMS keys in both regions and configure Aurora Auto Scaling for readers in both the primary and secondary regions.

Deploying an Amazon Aurora Global Database with customer managed KMS keys and reader auto scaling satisfies all requirements. Aurora Global Database has sub-second replication latency (meeting RPO) and can be promoted to a primary cluster in under a minute (meeting RTO). Reader auto scaling handles peak loads in both regions, and customer managed KMS keys allow the required cross-region decryption configurations.

Adım Adım Çözüm

Evaluate the RTO/RPO requirements.

An RPO under 5 seconds and RTO under 2 minutes require continuous, low-latency cross-region replication and rapid promotion of the secondary cluster, which are features of Amazon Aurora Global Database.

This rules out backup-and-restore strategies that take hours.

Determine the scale-out reader requirements.

Using Aurora Auto Scaling on readers in both regions allows local read performance scaling during traffic surges.

Amazon RDS Multi-AZ standby instances cannot serve traffic and do not solve read performance spikes.

Analyze cross-region database encryption constraints.

Customer managed KMS keys must be used because AWS-managed KMS keys do not support policy modifications required for cross-region encryption key sharing.

Ensures the replication infrastructure has the necessary permissions to decrypt data in the secondary region.

Anahtar Kavram

Multi-region database design balancing replication lag, read scaling, and KMS encryption compatibility.

Soru 15Soru →

An enterprise is modernizing a legacy, high-volume batch processing and reporting workload by migrating it to a serverless architecture on AWS. The solution uses an Amazon API Gateway Regional REST API backed by AWS Lambda functions that read from and write to an Amazon Aurora PostgreSQL database. During peak load tests, the Lambda functions throttle other critical applications in the same AWS region, and outbound calls from Lambda to external verification APIs occasionally fail due to NAT gateway availability issues in a single Availability Zone. Which combination of architectural modifications will resolve these issues while maintaining high availability and security best practices? (Select TWO.)

Geçerli olan tümünü seçin

Configure reserved concurrency on the high-volume batch processing Lambda function to limit its maximum concurrent executions and protect other critical applications.

Deploy NAT Gateways in multiple Availability Zones and update the route tables of the private subnets containing the Lambda functions to route outbound traffic through the local NAT Gateway in each zone.

Configure provisioned concurrency on the batch processing Lambda function to guarantee baseline execution capacity without setting a maximum ceiling, allowing it to scale dynamically to consume the entire regional concurrency pool.

Route all Lambda egress traffic through a single NAT Gateway deployed in a single Availability Zone to centralize traffic tracking and reduce active NAT Gateway hourly charges.

Configure the Lambda functions to encrypt sensitive application configuration files using the AWS-managed KMS key for Lambda (aws/lambda) and modify the key policy to delegate decryption permissions to a secondary auditing account.

Cevabı ve açıklamayı göster

Cevap: Configure reserved concurrency on the high-volume batch processing Lambda function to limit its maximum concurrent executions and protect other critical applications.; Deploy NAT Gateways in multiple Availability Zones and update the route tables of the private subnets containing the Lambda functions to route outbound traffic through the local NAT Gateway in each zone.

Cevap

Configure reserved concurrency on the high-volume batch processing Lambda function to limit its concurrent executions, and deploy NAT Gateways across multiple Availability Zones to ensure redundant egress paths.

Configuring reserved concurrency on the high-volume batch processing function establishes a hard limit on the number of concurrent executions it can consume. This prevents the function from exhausting the regional concurrency pool, ensuring that other critical functions in the same region remain operational. Additionally, deploying NAT Gateways in multiple Availability Zones and configuring the corresponding subnet route tables ensures high availability and redundancy for outbound connections to external APIs, preventing single-AZ failures from disrupting egress traffic.

Adım Adım Çözüm

Analyze the cause of regional function throttling.

The high-volume Lambda function dynamically scales to consume the shared regional concurrency limit (default 1,000), which starves other critical applications.

A hard limit must be set using reserved concurrency to isolate and protect the shared regional execution pool.

Evaluate the egress networking path for outbound API calls.

Egress calls fail when a single NAT Gateway experiences issues or its Availability Zone is degraded.

To ensure reliable external API communication, NAT Gateways must be distributed across multiple Availability Zones, and route tables must be updated accordingly.

Assess key policy permissions for environment encryption.

AWS-managed keys do not permit key policy edits for cross-account access delegation.

This rules out the option attempting to modify the policy of the aws/lambda key, confirming that customer-managed keys are required for custom policies.

Anahtar Kavram

Mitigating resource exhaustion through Lambda reserved concurrency, and ensuring outbound network redundancy using multi-AZ NAT Gateways.

Soru 16Soru →

An electric vehicle (EV) charging network provider is designing a new global charging session management system. The system must process real-time telemetry and session initialization requests from $200,000$ charging stations. At the start of peak operational hours, session initialization requests spike from $2,000$ requests per second to $60,000$ requests per second within a $1$ -minute window. The system must process these requests with sub-100ms latency, validate the user's account status, verify charger availability, and persist session records. The read-to-write ratio is $4:1$ .

The architecture uses Amazon Route 53, an Application Load Balancer (ALB), and Amazon ECS on AWS Fargate for the API layer. The database layer is Amazon Aurora PostgreSQL.

Which two actions should the Solutions Architect recommend to ensure the platform scales efficiently and meets the performance requirements during peak traffic? (Select TWO.)

Geçerli olan tümünü seçin

Request AWS Support to pre-warm the Application Load Balancer (ALB) to the expected peak throughput before the scheduled start of peak hours, and configure Amazon ECS Scheduled Scaling to scale out the Fargate tasks to the anticipated capacity prior to the spike.

Implement Amazon ElastiCache for Redis to cache charger availability and user account status, and configure Amazon Aurora Auto Scaling to scale read replicas horizontally while maintaining a minimum replica count sufficient to absorb the initial burst.

Configure the ECS Fargate tasks to scale out using dynamic target tracking based on CPU utilization, and configure the Amazon Aurora Multi-AZ standby instance in the secondary Availability Zone to serve read traffic during peak periods.

Implement Amazon ElastiCache for Memcached to replicate session states and cache database queries, and set the Auto Scaling cooldown period for the Fargate tasks to 10 seconds to allow rapid scale-out.

Rely on the Application Load Balancer's default automatic scaling to absorb the spike, and configure Amazon Aurora Auto Scaling to dynamically scale the primary writer instance to a larger DB instance class during the event.

Cevabı ve açıklamayı göster

Cevap: Request AWS Support to pre-warm the Application Load Balancer (ALB) to the expected peak throughput before the scheduled start of peak hours, and configure Amazon ECS Scheduled Scaling to scale out the Fargate tasks to the anticipated capacity prior to the spike.; Implement Amazon ElastiCache for Redis to cache charger availability and user account status, and configure Amazon Aurora Auto Scaling to scale read replicas horizontally while maintaining a minimum replica count sufficient to absorb the initial burst.

Cevap

Request AWS Support to pre-warm the Application Load Balancer and configure ECS Scheduled Scaling before the event, and implement Amazon ElastiCache for Redis along with a pre-configured minimum replica count for Aurora Read Replicas.

To support a sudden 30-fold increase in traffic within a single minute, reactive scaling mechanisms are insufficient. Pre-warming the Application Load Balancer (ALB) ensures that AWS scales the load balancer's capacity ahead of time, preventing dropped connections at the start of the peak. Similarly, configuring Amazon ECS Scheduled Scaling ensures that Fargate tasks are fully provisioned and ready to accept traffic before the spike starts. To optimize the database layer, implementing Amazon ElastiCache for Redis offloads the frequent read operations (charger availability and account status) from the database. For the remaining reads, setting a high minimum count for Aurora Read Replicas ensures that read capacity is already in place to absorb the initial query spike.

Adım Adım Çözüm

Analyze the workload characteristics and scaling limits.

The traffic spikes 30-fold from

2,000\text{ rps}

60,000\text{ rps}

within

1

minute. Standard reactive scaling mechanisms (ALB auto-scaling, ECS target tracking, and Aurora Auto Scaling) have latency in spawning resources and will fail to absorb the sudden burst.

This establishes that proactive scaling strategies are required at the entry and compute layers to prevent performance degradation.

Address the load balancing and compute provisioning layers.

Pre-warming the ALB configures the load balancer for the target peak throughput beforehand. ECS Scheduled Scaling pre-allocates Fargate tasks to match the target capacity right before the peak hours begin, eliminating startup delay.

This guarantees that incoming connections are not dropped at the ingress point and that sufficient backend container capacity exists immediately.

Optimize the database layer for read and write loads.

Amazon ElastiCache for Redis caches the read-heavy transactions (charger availability and account status). Setting a high minimum reader count for Aurora Read Replicas pre-warms the database scaling pool for any uncached reads.

This isolates the primary database instance from write starvation and read latency spikes, adhering to AWS database best practices.

Anahtar Kavram

Proactive scaling and caching strategies are required to handle rapid, massive traffic spikes that exceed the response times of reactive auto-scaling policies.

Tahmini Süre:3m 0s

Soru 17Soru →

A logistics company is designing a real-time fleet monitoring platform for $10$ million active delivery vehicles. Each vehicle transmits telemetry data every $5$ seconds over HTTPS, resulting in a sustained ingestion rate of $2$ million requests per second. The peak request volume can suddenly double in less than a minute. The system must process these updates with a sub-second latency envelope and store them in a persistent data store. The engineering team also needs to query the latest vehicle positions with sub-millisecond latency. Which architecture meets these requirements with the highest performance and reliability, while minimizing operational overhead?

Deploy an Application Load Balancer (ALB) to route incoming HTTPS requests to an Amazon Elastic Container Service (ECS) service on AWS Fargate. The ECS tasks process the updates, write the latest positions to an Amazon ElastiCache for Redis replication group with Multi-AZ enabled, and write the historical telemetry to an Amazon DynamoDB table in On-Demand capacity mode.

Deploy a Network Load Balancer (NLB) to route incoming HTTPS requests to an Amazon Elastic Container Service (ECS) service on AWS Fargate. The ECS tasks process the updates, write the latest positions to an Amazon ElastiCache for Memcached cluster with Multi-AZ replication enabled, and write the historical telemetry to an Amazon DynamoDB table in On-Demand capacity mode.

Deploy a Network Load Balancer (NLB) to route incoming HTTPS requests to an Amazon Elastic Container Service (ECS) service on AWS Fargate. The ECS tasks process the updates, write the latest positions to an Amazon ElastiCache for Redis replication group with Multi-AZ enabled, and write the historical telemetry to an Amazon DynamoDB table in On-Demand capacity mode.

Deploy a Network Load Balancer (NLB) to route incoming HTTPS requests to an Amazon Elastic Container Service (ECS) service on AWS Fargate. The ECS tasks process the updates, write the latest positions to an Amazon RDS for PostgreSQL database configured with Multi-AZ, and configure the application to scale read queries for latest positions by directing them to the Multi-AZ standby instance.

Cevabı ve açıklamayı göster

Cevap: Deploy a Network Load Balancer (NLB) to route incoming HTTPS requests to an Amazon Elastic Container Service (ECS) service on AWS Fargate. The ECS tasks process the updates, write the latest positions to an Amazon ElastiCache for Redis replication group with Multi-AZ enabled, and write the historical telemetry to an Amazon DynamoDB table in On-Demand capacity mode.

Cevap

Deploy a Network Load Balancer (NLB) to route incoming HTTPS requests to an Amazon Elastic Container Service (ECS) service on AWS Fargate. The ECS tasks process the updates, write the latest positions to an Amazon ElastiCache for Redis replication group with Multi-AZ enabled, and write the historical telemetry to an Amazon DynamoDB table in On-Demand capacity mode.

The architecture combining a Network Load Balancer (NLB), Amazon ECS on Fargate, Amazon ElastiCache for Redis (Multi-AZ), and Amazon DynamoDB (On-Demand) is correct because it ensures instant scaling to handle massive traffic spikes without pre-warming, provides sub-millisecond read latency for latest positions with high availability, and persists historical telemetry with zero manual capacity scaling overhead.

Adım Adım Çözüm

Analyze the entry point scaling requirements for the ingestion tier.

Determine that a Network Load Balancer (NLB) is required rather than an Application Load Balancer (ALB) because NLB can handle sudden spikes of millions of requests per second without pre-warming, which is critical since traffic can double from

2

million to

4

million requests per second in less than a minute.

To prevent request drops and high latency during sudden flash traffic surges.

Evaluate the caching tier for low-latency queries of the latest vehicle positions.

Identify that Amazon ElastiCache for Redis configured with Multi-AZ replication is required to achieve sub-millisecond query performance and ensure high availability, whereas Memcached lacks replication and Multi-AZ capabilities.

To satisfy the sub-millisecond read latency requirement while ensuring high availability during failovers.

Evaluate the persistent database layer for high-throughput writes.

Select Amazon DynamoDB in On-Demand capacity mode to persistently store the historical telemetry, as it handles unpredictable and massive write spikes automatically without manual capacity management, while avoiding RDS Multi-AZ standby instances which cannot serve read traffic to scale query workloads.

To manage operational overhead and handle massive persistent write volume without scale bottlenecks.

Anahtar Kavram

Selecting and configuring AWS ingestion, caching, and database services to optimize performance and handle massive, sudden scaling requirements without operational bottlenecks.

Soru 18Soru →

An enterprise is designing a centralized auditing solution where a data ingestion application running under an IAM role in a Production account (111122223333) must write audit logs to an Amazon S3 bucket located in a Security account (444455556666). The compliance requirements state that all logs must be encrypted at rest, and a compliance auditor using a role in the Audit account (777788889999) must be able to read and decrypt the logs. Additionally, to maintain chain of custody, administrators in the Production account must not have the ability to decrypt the logs once they are uploaded. Which configuration meets these requirements?

Create both the S3 bucket and a customer managed key (CMK) in the Security account. Configure S3 default encryption on the bucket using this CMK. Update the KMS key policy to grant kms:GenerateDataKey to the Production application role, and kms:Decrypt to the Audit compliance role. Configure the S3 bucket policy to allow s3:PutObject from the Production application role and s3:GetObject from the Audit compliance role.

Configure the S3 bucket in the Security account to use default S3 encryption with the AWS managed key (aws/s3). Create a bucket policy that grants s3:PutObject to the Production application role and s3:GetObject to the Audit compliance role. Grant the Audit compliance role decryption permissions using local IAM policies in the Production account.

Create both the S3 bucket and a customer managed key (CMK) in the Security account. Create a Service Control Policy (SCP) at the AWS Organizations root level that allows the Audit compliance role to perform kms:Decrypt and s3:GetObject on the Security account resources. Attach this SCP to the OUs containing the Production and Audit accounts.

Create the S3 bucket and a customer managed key (CMK) in the Security account. Configure the KMS key policy to trust the Audit account for kms:Decrypt operations. Authorize the Audit compliance role to read S3 objects by configuring local IAM policies in the Audit account, without adding the Audit role to the S3 bucket policy in the Security account.

Cevabı ve açıklamayı göster

Cevap: Create both the S3 bucket and a customer managed key (CMK) in the Security account. Configure S3 default encryption on the bucket using this CMK. Update the KMS key policy to grant kms:GenerateDataKey to the Production application role, and kms:Decrypt to the Audit compliance role. Configure the S3 bucket policy to allow s3:PutObject from the Production application role and s3:GetObject from the Audit compliance role.

Cevap

Create both the S3 bucket and a customer managed key (CMK) in the Security account, configure S3 default encryption using this CMK, grant key permissions to the respective roles, and configure the S3 bucket policy to explicitly allow cross-account access.

The correct option correctly positions the customer managed KMS key (CMK) and the S3 bucket within the Security account. This architecture prevents Production account administrators from overriding policies or obtaining decryption permissions. The KMS key policy explicitly permits the Production application to generate data keys for encryption, while permitting the Audit compliance role to decrypt the data. The S3 bucket policy permits the necessary cross-account read and write operations, satisfying all compliance and access requirements.

Adım Adım Çözüm

Select the correct KMS key type for cross-account sharing.

Determine that a Customer Managed Key (CMK) is required because AWS managed keys (such as aws/s3) cannot be shared across accounts due to immutable key policies.

AWS managed keys restrict access to the local account, so cross-account decryption requires a customer managed key.

Determine the resource hosting account for compliance separation.

Create the KMS CMK and S3 bucket in the Security account.

By hosting the KMS key in the Security account, Production account administrators cannot access or modify the key policy, preserving the chain of custody.

Configure the resource-based access policies in the Security account.

Grant write access (s3:PutObject and kms:GenerateDataKey) to the Production application role, and read access (s3:GetObject and kms:Decrypt) to the Audit compliance role.

Resource-based policies (bucket policy and KMS key policy) must explicitly authorize cross-account actions for the external accounts to access resources.

Anahtar Kavram

Cross-account S3 and KMS key policy delegation for regulatory data segregation.

Soru 19Soru →

A global company has a multi-account AWS environment with $40$ spoke VPCs distributed across us-east-1 and us-west-2. The company is designing a hybrid network architecture to connect these VPCs to an on-premises data center with a redundant AWS Direct Connect (DX) infrastructure. The solution must allow spoke VPCs to communicate with the data center and with each other across regions. Additionally, all VPCs must resolve private DNS names hosted on-premises and in a centralized AWS Route 53 Private Hosted Zone (PHZ) in a shared services account, while outbound internet traffic must be routed through centralized NAT Gateways to minimize costs while maintaining high availability. Which architecture meets these requirements with the least administrative overhead and maintains high availability?

Deploy an AWS Transit Gateway (TGW) in each region and peer them. Attach the spoke VPCs to their regional TGW. Associate a Direct Connect Gateway (DXGW) with a Transit VIF on the Direct Connect connections, and associate the DXGW with the TGW in each region. In the shared services account, associate the Route 53 Private Hosted Zone (PHZ) with the spoke VPCs in both regions, and deploy centralized Route 53 Resolver outbound endpoints to forward on-premises queries. In each region, deploy redundant NAT Gateways across multiple Availability Zones in a dedicated egress VPC attached to the TGW, routing all outbound traffic (

0.0.0.0/0

) from the spoke VPCs to the egress VPC.

Connect the spoke VPCs in each region directly to a centralized Direct Connect Gateway (DXGW) using Private Virtual Interfaces (VIFs) to enable transitive routing between the VPCs and to the on-premises data center. Associate the centralized PHZ with the DXGW to enable DNS resolution across all accounts. Deploy a single NAT Gateway in the shared services VPC in the primary region to handle all egress traffic for both regions.

Deploy an AWS Transit Gateway (TGW) in each region and peer them. Attach the spoke VPCs to their regional TGW. Associate a Direct Connect Gateway (DXGW) with a Transit VIF on the Direct Connect connections, and associate the DXGW with the TGW in each region. Create a duplicate Route 53 PHZ in each individual spoke AWS account to avoid cross-account VPC associations, and configure Route 53 Resolver outbound endpoints in each spoke VPC to resolve on-premises domains. In each region, deploy redundant NAT Gateways across multiple Availability Zones in a dedicated egress VPC attached to the TGW, routing all outbound traffic (

0.0.0.0/0

) from the spoke VPCs to the egress VPC.

Deploy an AWS Transit Gateway (TGW) in each region and peer them. Attach the spoke VPCs to their regional TGW. Associate a Direct Connect Gateway (DXGW) with a Transit VIF on the Direct Connect connections, and associate the DXGW with the TGW in each region. In the shared services account, associate the Route 53 Private Hosted Zone (PHZ) with the spoke VPCs in both regions, and deploy centralized Route 53 Resolver outbound endpoints to forward on-premises queries. In each region, deploy a single NAT Gateway in a single Availability Zone within a dedicated egress VPC attached to the TGW, routing all outbound traffic (

0.0.0.0/0

) from the spoke VPCs to the egress VPC to reduce NAT Gateway costs.

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway (TGW) in each region and peer them. Attach the spoke VPCs to their regional TGW. Associate a Direct Connect Gateway (DXGW) with a Transit VIF on the Direct Connect connections, and associate the DXGW with the TGW in each region. In the shared services account, associate the Route 53 Private Hosted Zone (PHZ) with the spoke VPCs in both regions, and deploy centralized Route 53 Resolver outbound endpoints to forward on-premises queries. In each region, deploy redundant NAT Gateways across multiple Availability Zones in a dedicated egress VPC attached to the TGW, routing all outbound traffic ( $0.0.0.0/0$ ) from the spoke VPCs to the egress VPC.

Cevap

Deploy regional Transit Gateways (TGWs) peered together, associate them with a Direct Connect Gateway (DXGW) via a Transit VIF, associate the centralized Private Hosted Zone (PHZ) with all spoke VPCs, utilize shared Route 53 Resolver outbound endpoints, and route egress traffic through dedicated egress VPCs with redundant NAT Gateways in each region.

The architecture that peers regional Transit Gateways (TGWs) and associates them with a Direct Connect Gateway (DXGW) via a Transit VIF provides multi-region, multi-account hybrid connectivity with minimal VIF management. Centralizing Route 53 Resolver outbound endpoints in a shared services account and sharing the forwarding rules via AWS Resource Access Manager (RAM) to the spoke VPCs is the most cost-effective and operationally efficient way to resolve on-premises DNS names. Cross-account association of the Route 53 Private Hosted Zone (PHZ) enables all VPCs to resolve internal AWS domains without duplicating hosted zones. Finally, placing redundant NAT Gateways across multiple Availability Zones in dedicated egress VPCs ensures high availability for outbound traffic while centralizing egress management.

Adım Adım Çözüm

Establish multi-account, multi-region hybrid connectivity.

Attach spoke VPCs to regional Transit Gateways, peer the Transit Gateways, and connect them to the on-premises data center using a Direct Connect Gateway with a Transit VIF.

This pattern simplifies BGP routing, minimizes VIF configuration, and enables both VPC-to-on-premises and transitive cross-region VPC-to-VPC routing.

Design a centralized and scalable DNS resolution architecture.

Associate the centralized Private Hosted Zone in the shared services account with the spoke VPCs, and deploy central Route 53 Resolver outbound endpoints, sharing the forwarding rules with all accounts via Resource Access Manager.

This avoids the administrative overhead of duplicating hosted zones and the high cost of deploying duplicate Resolver endpoints in every spoke VPC.

Design a highly available and cost-effective internet egress path.

Configure dedicated egress VPCs attached to the Transit Gateways with redundant NAT Gateways across multiple Availability Zones in each region.

Centralizing NAT Gateways reduces NAT Gateway hourly charges compared to deploying them in every spoke VPC, while using multiple Availability Zones ensures high availability for egress traffic.

Anahtar Kavram

Multi-region hybrid network integration using AWS Transit Gateway, Direct Connect Gateway, cross-account Route 53 Resolver endpoints, and centralized egress VPCs.

Tahmini Süre:2m 0s

Soru 20Soru →

A company wants to consolidate application logs from Amazon CloudWatch Logs across multiple AWS accounts in an AWS Organization into a centralized Amazon S3 bucket located in a dedicated Security account. The security team wants to stream these logs in near-real-time using Amazon Kinesis Data Firehose in the Security account, and they need to ensure secure cross-account delivery. Which two steps must the solutions architect take to configure this cross-account log aggregation topology? (Select TWO.)

Geçerli olan tümünü seçin

In the Security account, create a CloudWatch Logs destination that points to the Kinesis Data Firehose delivery stream and references an IAM role that allows CloudWatch Logs to write to the stream. Configure a destination policy on the CloudWatch Logs destination that grants the member accounts permission to perform the logs:PutSubscriptionFilter action.

In each member account, create a CloudWatch Logs subscription filter on the target application log groups, specifying the Amazon Resource Name (ARN) of the CloudWatch Logs destination in the Security account as the target.

In the Security account, configure the S3 bucket policy of the destination bucket to grant logs.amazonaws.com and the member account IDs direct s3:PutObject permissions, and configure the source accounts to write to the S3 bucket directly.

In the Security account, encrypt the Kinesis Data Firehose delivery stream using the AWS-managed KMS key (aws/kinesis) and modify its key policy to allow the member account IAM roles to perform kms:GenerateDataKey and kms:Decrypt actions.

Attach a Service Control Policy (SCP) at the root of the AWS Organization that grants member accounts the logs:PutSubscriptionFilter permission to automatically push all CloudWatch log groups to the central destination without local configuration.

Cevabı ve açıklamayı göster

Cevap: In the Security account, create a CloudWatch Logs destination that points to the Kinesis Data Firehose delivery stream and references an IAM role that allows CloudWatch Logs to write to the stream. Configure a destination policy on the CloudWatch Logs destination that grants the member accounts permission to perform the logs:PutSubscriptionFilter action.; In each member account, create a CloudWatch Logs subscription filter on the target application log groups, specifying the Amazon Resource Name (ARN) of the CloudWatch Logs destination in the Security account as the target.

Cevap

The correct configurations involve creating a CloudWatch Logs destination in the Security account that points to the Kinesis Data Firehose delivery stream, configuring a destination policy allowing the source accounts to execute logs:PutSubscriptionFilter, and creating a subscription filter on the target log groups in the member accounts referencing the Security account's destination ARN.

Setting up a CloudWatch Logs destination in the Security account with a resource policy allowing logs:PutSubscriptionFilter, along with configuring local subscription filters in the source accounts targeting the destination's ARN, correctly implements the cross-account subscription filter architecture. The destination is associated with an IAM service role that authorizes CloudWatch Logs to write to Kinesis Data Firehose.

Adım Adım Çözüm

Set up the target ingestion stream in the centralized Logging/Security account.

Create an Amazon Kinesis Data Firehose delivery stream configured to write to the destination S3 bucket.

This provides the ingestion pipeline for incoming streaming log data from all organization accounts.

Establish cross-account trust and log destination properties in the Security account.

Create a CloudWatch Logs destination referencing the Kinesis Data Firehose stream and an IAM role with a trust policy for logs.amazonaws.com. Attach a destination policy using PutDestinationPolicy to allow source accounts logs:PutSubscriptionFilter access.

This creates the endpoint that source accounts can target and authorizes cross-account access securely.

Configure log groups in the source member accounts to forward events.

Create a CloudWatch Logs subscription filter in each member account's target log groups pointing to the central destination ARN.

This establishes the active forwarding mechanism to stream local CloudWatch log events to the central destination.

Anahtar Kavram

Cross-account log aggregation with CloudWatch Logs requires establishing a CloudWatch Logs Destination in the receiving account, securing it via a resource-based destination policy, and creating local subscription filters targeting that destination in the sending accounts.

Sayfa 1 / 99Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram